d1959dd6cf
Deploys Nextcloud using an FPM-alpine image with a Caddy sidecar for web serving. Integrates with an external CloudNativePG cluster for PostgreSQL and a dedicated Valkey instance for caching. Configures S3-compatible object storage for file data. Includes an initialization Job to create essential admin and Valkey secrets. Sets up Ingress for external access with automated TLS provisioning via cert-manager. Configures local-path persistence for Nextcloud's core data to ensure state is maintained across pod restarts. Centralizes hostname configuration and migrates various Nextcloud settings to environment variables for streamlined management. Adds ArgoCD ignore rules for `batch/Job` resource selectors and template labels, preventing spurious out-of-sync states caused by Kubernetes mutations and improving synchronization stability.
359 lines
12 KiB
YAML
359 lines
12 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
annotations:
|
|
a8r.io/repository: ssh://git@git.tr1ceracop.de:222/gitea_admin/k8s-and-chill.git
|
|
labels:
|
|
app.kubernetes.io/component: app
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/managed-by: Helm
|
|
app.kubernetes.io/name: nextcloud
|
|
app.kubernetes.io/version: 33.0.0
|
|
helm.sh/chart: nextcloud-9.0.4
|
|
name: nextcloud
|
|
namespace: nextcloud
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app.kubernetes.io/component: app
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: nextcloud
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
annotations:
|
|
hooks-hash: 9525c2748a6c7cd0e28ec740623d0b3fa5a75c83b51ccfd136bc89c76737b204
|
|
nextcloud-config-hash: 97fd373864ae7c5da0eb066761ee479483364e3957160cacca360fc6a66c03f7
|
|
php-config-hash: b638f66fd8d65de8364dbad6efc59a6524c7b2e2377b5623cf5e921e4d3d2400
|
|
labels:
|
|
app.kubernetes.io/component: app
|
|
app.kubernetes.io/instance: nextcloud
|
|
app.kubernetes.io/name: nextcloud
|
|
spec:
|
|
containers:
|
|
- env:
|
|
- name: POSTGRES_HOST
|
|
value: nextcloud-cnpg-rw.nextcloud.svc:5432
|
|
- name: POSTGRES_DB
|
|
value: nextcloud
|
|
- name: POSTGRES_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: username
|
|
name: nextcloud-cnpg-app
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: nextcloud-cnpg-app
|
|
- name: NEXTCLOUD_ADMIN_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: nextcloud-username
|
|
name: nextcloud-admin-secret
|
|
- name: NEXTCLOUD_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: nextcloud-password
|
|
name: nextcloud-admin-secret
|
|
- name: NEXTCLOUD_TRUSTED_DOMAINS
|
|
value: nextcloud.tr1ceracop.de
|
|
- name: OPENMETRICS_ALLOWED_CLIENTS
|
|
value: 127.0.0.1,10.42.0.0/16,10.43.0.0/16
|
|
- name: NEXTCLOUD_DATA_DIR
|
|
value: /var/www/html/data
|
|
- name: REDIS_HOST
|
|
value: nextcloud-valkey.nextcloud.svc
|
|
- name: REDIS_HOST_PORT
|
|
value: "6379"
|
|
- name: REDIS_HOST_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: nextcloud-valkey-password
|
|
- name: OBJECTSTORE_S3_SSL
|
|
value: "true"
|
|
- name: OBJECTSTORE_S3_USEPATH_STYLE
|
|
value: "true"
|
|
- name: OBJECTSTORE_S3_AUTOCREATE
|
|
value: "false"
|
|
- name: OBJECTSTORE_S3_REGION
|
|
value: nbg1
|
|
- name: OBJECTSTORE_S3_PORT
|
|
value: "443"
|
|
- name: OBJECTSTORE_S3_STORAGE_CLASS
|
|
value: STANDARD
|
|
- name: OBJECTSTORE_S3_HOST
|
|
value: nbg1.your-objectstorage.com
|
|
- name: OBJECTSTORE_S3_BUCKET
|
|
value: nextcloud-tr1ceracop
|
|
- name: OBJECTSTORE_S3_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: ACCESS_KEY_ID
|
|
name: nextcloud-s3-credentials
|
|
- name: OBJECTSTORE_S3_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: SECRET_ACCESS_KEY
|
|
name: nextcloud-s3-credentials
|
|
- name: OBJECTSTORE_S3_SSE_C_KEY
|
|
value: ""
|
|
- name: TRUSTED_PROXIES
|
|
value: 10.0.0.0/8
|
|
- name: OVERWRITEPROTOCOL
|
|
value: https
|
|
- name: OVERWRITEHOST
|
|
value: nextcloud.tr1ceracop.de
|
|
- name: OVERWRITECLIURL
|
|
value: https://nextcloud.tr1ceracop.de
|
|
- name: NC_default_phone_region
|
|
value: DE
|
|
image: docker.io/library/nextcloud:33.0.0-fpm-alpine
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
httpHeaders:
|
|
- name: Host
|
|
value: nextcloud.tr1ceracop.de
|
|
path: /status.php
|
|
port: 80
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
name: nextcloud
|
|
ports:
|
|
- containerPort: 80
|
|
name: http
|
|
protocol: TCP
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
httpHeaders:
|
|
- name: Host
|
|
value: nextcloud.tr1ceracop.de
|
|
path: /status.php
|
|
port: 80
|
|
initialDelaySeconds: 10
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 5
|
|
resources:
|
|
limits:
|
|
memory: 512Mi
|
|
requests:
|
|
cpu: 200m
|
|
memory: 256Mi
|
|
volumeMounts:
|
|
- mountPath: /var/www/
|
|
name: nextcloud-main
|
|
subPath: root
|
|
- mountPath: /var/www/html
|
|
name: nextcloud-main
|
|
subPath: html
|
|
- mountPath: /var/www/html/data
|
|
name: nextcloud-main
|
|
subPath: data
|
|
- mountPath: /var/www/html/config
|
|
name: nextcloud-main
|
|
subPath: config
|
|
- mountPath: /var/www/html/custom_apps
|
|
name: nextcloud-main
|
|
subPath: custom_apps
|
|
- mountPath: /var/www/tmp
|
|
name: nextcloud-main
|
|
subPath: tmp
|
|
- mountPath: /var/www/html/themes
|
|
name: nextcloud-main
|
|
subPath: themes
|
|
- mountPath: /usr/local/etc/php/conf.d/opcache.ini
|
|
name: nextcloud-phpconfig
|
|
subPath: opcache.ini
|
|
- mountPath: /usr/local/etc/php/conf.d/uploadLimit.ini
|
|
name: nextcloud-phpconfig
|
|
subPath: uploadLimit.ini
|
|
- command:
|
|
- /cron.sh
|
|
env:
|
|
- name: POSTGRES_HOST
|
|
value: nextcloud-cnpg-rw.nextcloud.svc:5432
|
|
- name: POSTGRES_DB
|
|
value: nextcloud
|
|
- name: POSTGRES_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: username
|
|
name: nextcloud-cnpg-app
|
|
- name: POSTGRES_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: nextcloud-cnpg-app
|
|
- name: NEXTCLOUD_ADMIN_USER
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: nextcloud-username
|
|
name: nextcloud-admin-secret
|
|
- name: NEXTCLOUD_ADMIN_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: nextcloud-password
|
|
name: nextcloud-admin-secret
|
|
- name: NEXTCLOUD_TRUSTED_DOMAINS
|
|
value: nextcloud.tr1ceracop.de
|
|
- name: OPENMETRICS_ALLOWED_CLIENTS
|
|
value: 127.0.0.1,10.42.0.0/16,10.43.0.0/16
|
|
- name: NEXTCLOUD_DATA_DIR
|
|
value: /var/www/html/data
|
|
- name: REDIS_HOST
|
|
value: nextcloud-valkey.nextcloud.svc
|
|
- name: REDIS_HOST_PORT
|
|
value: "6379"
|
|
- name: REDIS_HOST_PASSWORD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: password
|
|
name: nextcloud-valkey-password
|
|
- name: OBJECTSTORE_S3_SSL
|
|
value: "true"
|
|
- name: OBJECTSTORE_S3_USEPATH_STYLE
|
|
value: "true"
|
|
- name: OBJECTSTORE_S3_AUTOCREATE
|
|
value: "false"
|
|
- name: OBJECTSTORE_S3_REGION
|
|
value: nbg1
|
|
- name: OBJECTSTORE_S3_PORT
|
|
value: "443"
|
|
- name: OBJECTSTORE_S3_STORAGE_CLASS
|
|
value: STANDARD
|
|
- name: OBJECTSTORE_S3_HOST
|
|
value: nbg1.your-objectstorage.com
|
|
- name: OBJECTSTORE_S3_BUCKET
|
|
value: nextcloud-tr1ceracop
|
|
- name: OBJECTSTORE_S3_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: ACCESS_KEY_ID
|
|
name: nextcloud-s3-credentials
|
|
- name: OBJECTSTORE_S3_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
key: SECRET_ACCESS_KEY
|
|
name: nextcloud-s3-credentials
|
|
- name: OBJECTSTORE_S3_SSE_C_KEY
|
|
value: ""
|
|
- name: TRUSTED_PROXIES
|
|
value: 10.0.0.0/8
|
|
- name: OVERWRITEPROTOCOL
|
|
value: https
|
|
- name: OVERWRITEHOST
|
|
value: nextcloud.tr1ceracop.de
|
|
- name: OVERWRITECLIURL
|
|
value: https://nextcloud.tr1ceracop.de
|
|
- name: NC_default_phone_region
|
|
value: DE
|
|
image: docker.io/library/nextcloud:33.0.0-fpm-alpine
|
|
imagePullPolicy: IfNotPresent
|
|
name: nextcloud-cron
|
|
resources: {}
|
|
volumeMounts:
|
|
- mountPath: /var/www/
|
|
name: nextcloud-main
|
|
subPath: root
|
|
- mountPath: /var/www/html
|
|
name: nextcloud-main
|
|
subPath: html
|
|
- mountPath: /var/www/html/data
|
|
name: nextcloud-main
|
|
subPath: data
|
|
- mountPath: /var/www/html/config
|
|
name: nextcloud-main
|
|
subPath: config
|
|
- mountPath: /var/www/html/custom_apps
|
|
name: nextcloud-main
|
|
subPath: custom_apps
|
|
- mountPath: /var/www/tmp
|
|
name: nextcloud-main
|
|
subPath: tmp
|
|
- mountPath: /var/www/html/themes
|
|
name: nextcloud-main
|
|
subPath: themes
|
|
- mountPath: /usr/local/etc/php/conf.d/opcache.ini
|
|
name: nextcloud-phpconfig
|
|
subPath: opcache.ini
|
|
- mountPath: /usr/local/etc/php/conf.d/uploadLimit.ini
|
|
name: nextcloud-phpconfig
|
|
subPath: uploadLimit.ini
|
|
- image: caddy:2-alpine
|
|
livenessProbe:
|
|
httpGet:
|
|
httpHeaders:
|
|
- name: Host
|
|
value: nextcloud.tr1ceracop.de
|
|
path: /status.php
|
|
port: 80
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 15
|
|
timeoutSeconds: 5
|
|
name: caddy
|
|
ports:
|
|
- containerPort: 80
|
|
name: http
|
|
protocol: TCP
|
|
readinessProbe:
|
|
httpGet:
|
|
httpHeaders:
|
|
- name: Host
|
|
value: nextcloud.tr1ceracop.de
|
|
path: /status.php
|
|
port: 80
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 15
|
|
timeoutSeconds: 5
|
|
resources:
|
|
limits:
|
|
memory: 64Mi
|
|
requests:
|
|
cpu: 50m
|
|
memory: 32Mi
|
|
volumeMounts:
|
|
- mountPath: /var/www/
|
|
name: nextcloud-main
|
|
subPath: root
|
|
- mountPath: /var/www/html
|
|
name: nextcloud-main
|
|
subPath: html
|
|
- mountPath: /var/www/html/data
|
|
name: nextcloud-main
|
|
subPath: data
|
|
- mountPath: /var/www/html/config
|
|
name: nextcloud-main
|
|
subPath: config
|
|
- mountPath: /var/www/html/custom_apps
|
|
name: nextcloud-main
|
|
subPath: custom_apps
|
|
- mountPath: /var/www/tmp
|
|
name: nextcloud-main
|
|
subPath: tmp
|
|
- mountPath: /var/www/html/themes
|
|
name: nextcloud-main
|
|
subPath: themes
|
|
- mountPath: /etc/caddy
|
|
name: caddy-config
|
|
securityContext:
|
|
fsGroup: 33
|
|
volumes:
|
|
- name: nextcloud-main
|
|
persistentVolumeClaim:
|
|
claimName: nextcloud-nextcloud
|
|
- configMap:
|
|
name: nextcloud-phpconfig
|
|
name: nextcloud-phpconfig
|
|
- configMap:
|
|
name: nextcloud-caddy-config
|
|
name: caddy-config
|